2 lines
3.2 KiB
JSON
2 lines
3.2 KiB
JSON
{"affected":[{"affectedData":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"source":"cve@mitre.org"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:zammad:zammad:*:*:*:*:*:*:*:*","matchCriteriaId":"113864CB-718D-4B62-BD84-587A1DE8ED19","versionEndIncluding":"1.0.3","vulnerable":true},{"criteria":"cpe:2.3:a:zammad:zammad:1.1.0:*:*:*:*:*:*:*","matchCriteriaId":"7349B6BD-C108-4120-BD42-7FD3B39E46DA","vulnerable":true},{"criteria":"cpe:2.3:a:zammad:zammad:1.1.1:*:*:*:*:*:*:*","matchCriteriaId":"F9F1D9BF-4A1B-4C55-89FE-AE174BD9994D","vulnerable":true},{"criteria":"cpe:2.3:a:zammad:zammad:1.1.2:*:*:*:*:*:*:*","matchCriteriaId":"327D5DB8-7B7E-4BFA-8329-28BEB3BCE6C6","vulnerable":true},{"criteria":"cpe:2.3:a:zammad:zammad:1.2.0:*:*:*:*:*:*:*","matchCriteriaId":"6A5511A6-864E-4069-951C-A0E0C38C6655","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"An issue was discovered in Zammad before 1.0.4, 1.1.x before 1.1.3, and 1.2.x before 1.2.1. Attackers can login with the hashed password itself (e.g., from the DB) instead of the valid password string."},{"lang":"es","value":"Se ha descubierto un problema en Zammad en versiones anteriores a 1.0.4, 1.1.x en versiones anteriores a 1.1.3 y 1.2.x en versiones anteriores a 1.2.1. Atacantes pueden iniciar sesión con la contraseña hash por sí misma (por ejemplo desde el DB) en lugar de con la cadena de contraseña válida."}],"id":"CVE-2017-5619","lastModified":"2026-06-17T01:20:51.677","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"HIGH","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"NONE","availabilityImpact":"PARTIAL","baseScore":7.5,"confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","version":"2.0"},"exploitabilityScore":10.0,"impactScore":6.4,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"nvd@nist.gov","type":"Primary","userInteractionRequired":false}],"cvssMetricV30":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.0"},"exploitabilityScore":3.9,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2017-03-13T06:59:00.293","references":[{"source":"cve@mitre.org","tags":["Third Party Advisory","VDB Entry"],"url":"http://www.securityfocus.com/bid/96937"},{"source":"cve@mitre.org","tags":["Vendor Advisory"],"url":"https://zammad.com/de/news/security-advisory-zaa-2017-01"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"url":"http://www.securityfocus.com/bid/96937"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"url":"https://zammad.com/de/news/security-advisory-zaa-2017-01"}],"sourceIdentifier":"cve@mitre.org","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-287"}],"source":"nvd@nist.gov","type":"Primary"}]}
|